diff options
| author | Mauro Carvalho Chehab <mchehab@osg.samsung.com> | 2016-04-27 19:28:26 -0300 |
|---|---|---|
| committer | Mauro Carvalho Chehab <mchehab@s-opensource.com> | 2016-06-15 17:57:24 -0300 |
| commit | a087ce704b802becbb4b0f2a20f2cb3f6911802e (patch) | |
| tree | 6cfa3f4ac4ef03bc7f7cc5fe4180a956f470213b /drivers/media/media-devnode.c | |
| parent | 163f1e93e995048b894c5fc86a6034d16beed740 (diff) | |
| download | op-kernel-dev-a087ce704b802becbb4b0f2a20f2cb3f6911802e.zip op-kernel-dev-a087ce704b802becbb4b0f2a20f2cb3f6911802e.tar.gz | |
[media] media-device: dynamically allocate struct media_devnode
struct media_devnode is currently embedded at struct media_device.
While this works fine during normal usage, it leads to a race
condition during devnode unregister. the problem is that drivers
assume that, after calling media_device_unregister(), the struct
that contains media_device can be freed. This is not true, as it
can't be freed until userspace closes all opened /dev/media devnodes.
In other words, if the media devnode is still open, and media_device
gets freed, any call to an ioctl will make the core to try to access
struct media_device, with will cause an use-after-free and even GPF.
Fix this by dynamically allocating the struct media_devnode and only
freeing it when it is safe.
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
Diffstat (limited to 'drivers/media/media-devnode.c')
| -rw-r--r-- | drivers/media/media-devnode.c | 7 |
1 files changed, 6 insertions, 1 deletions
diff --git a/drivers/media/media-devnode.c b/drivers/media/media-devnode.c index 7481c96..ecdc02d 100644 --- a/drivers/media/media-devnode.c +++ b/drivers/media/media-devnode.c @@ -44,6 +44,7 @@ #include <linux/uaccess.h> #include <media/media-devnode.h> +#include <media/media-device.h> #define MEDIA_NUM_DEVICES 256 #define MEDIA_NAME "media" @@ -74,6 +75,8 @@ static void media_devnode_release(struct device *cd) /* Release media_devnode and perform other cleanups as needed. */ if (devnode->release) devnode->release(devnode); + + kfree(devnode); } static struct bus_type media_bus_type = { @@ -219,7 +222,8 @@ static const struct file_operations media_devnode_fops = { .llseek = no_llseek, }; -int __must_check media_devnode_register(struct media_devnode *devnode, +int __must_check media_devnode_register(struct media_device *mdev, + struct media_devnode *devnode, struct module *owner) { int minor; @@ -238,6 +242,7 @@ int __must_check media_devnode_register(struct media_devnode *devnode, mutex_unlock(&media_devnode_lock); devnode->minor = minor; + devnode->media_dev = mdev; /* Part 2: Initialize and register the character device */ cdev_init(&devnode->cdev, &media_devnode_fops); |
